California Student Data Privacy & AI Compliance Statement
Compliance with FERPA, COPPA, SOPIPA, CCPA, AB 1584, SB 243, and California Education Code
1. Executive Summary
American Digital Education (ADE) is a K-12 EdTech platform that provides AI-powered, standards-based lessons to address America's literacy and numeracy crisis. This document details ADE's compliance posture with all applicable California and federal student data privacy laws, ensuring that Local Educational Agencies (LEAs) can adopt ADE with full confidence that student data is protected, AI systems are transparent, and all contractual and legal obligations are met.
2. Platform Architecture & Data Flow
Understanding how ADE's technical architecture works is essential to evaluating our compliance posture. ADE's system is designed from the ground up with a privacy-first architecture that ensures student PII never enters the AI pipeline.
How ADE Works
- ADE delivers standards-based lessons aligned to state curriculum frameworks.
- Lesson content is created using AI-assisted generation: curriculum text and instructional standards are sent to Google Gemini via API, and instructional content is returned.
- All AI-generated content passes through multiple layers of accuracy filters, pedagogical review, and safety guardrails before being delivered to students.
- The AI pipeline is a closed content-generation loop: text goes in, text comes back. No student names, IDs, performance data, behavioral data, or any other PII is included in any AI request.
Data Flow Summary
| Data Type | Sent to AI Model? | Stored by AI Vendor? |
|---|---|---|
| Student Names / IDs | No - Never | No - Never |
| Student Performance | No - Never | No - Never |
| Student Behavior | No - Never | No - Never |
| Student Demographics | No - Never | No - Never |
| Curriculum Text | Yes - for lesson generation only | No - not retained |
| Standards / Frameworks | Yes - for alignment only | No - not retained |
AI Model Usage
- ADE connects to Google Gemini via enterprise API under terms that explicitly prohibit the use of API inputs to train, retrain, or improve Google's AI models.
- API inputs are not retained by Google beyond the transient processing required to generate a response.
- ADE's Google API agreement includes a Data Processing Agreement (DPA) compatible with educational data protection requirements.
- Because no student PII is ever included in API requests, the risk profile is equivalent to sending a textbook passage for processing -- no student data is at risk.
3. Law-by-Law Compliance
The following section details ADE's specific compliance with each applicable California and federal law governing student data privacy, AI use, and procurement in K-12 educational settings.
Family Educational Rights and Privacy Act (FERPA)
| Requirement | ADE Compliance |
|---|---|
| No unauthorized disclosure of PII | ADE never collects, stores, or transmits student PII. No personally identifiable information is shared with any AI model or third party. |
| No re-release of student data | Because ADE does not possess student PII, there is no data to re-release. AI inputs contain only curriculum content. |
| Parent/guardian access rights | ADE does not maintain student education records. Any records generated within an LEA's learning management system remain under the LEA's control and FERPA obligations. |
| Open AI system prohibition | ADE's AI vendor (Google Gemini API) does not use inputs to train models. This constitutes a closed system for data protection purposes. |
Children's Online Privacy Protection Act (COPPA)
| Requirement | ADE Compliance |
|---|---|
| Limits on data collection from children under 13 | ADE does not collect personal information from children of any age. No registration, profiles, or data collection from minors occurs on the platform. |
| Parental consent for data collection | Not applicable -- ADE collects no personal data from students. LEAs may authorize use for educational purposes without additional consent obligations. |
| Data retained only as needed | No student data is collected or retained. Curriculum content processed via AI is transient and not stored by the AI vendor. |
Student Online Personal Information Protection Act (SOPIPA)
| Requirement | ADE Compliance |
|---|---|
| No use of student data for profiling | ADE does not create student profiles, behavioral models, or learning analytics based on individual student data. |
| No marketing to students or parents | ADE does not use any student interaction data for marketing, advertising, or commercial purposes of any kind. |
| Student data remains property of LEA/student/parent | ADE asserts no ownership over any student data. All educational records remain the exclusive property of the student, parent/guardian, and LEA. |
California Consumer Privacy Act (CCPA)
| Requirement | ADE Compliance |
|---|---|
| Right to know what data is collected | ADE collects no personal data from students. This is disclosed transparently in all contracts and this compliance document. |
| Right to delete personal information | Not applicable -- no personal information is collected or stored. |
| No dark patterns | ADE's interface does not employ manipulative or deceptive design elements that subvert user autonomy or decision-making. |
| No automated decision-making without notice | ADE does not make automated decisions about students. AI is used solely for content generation, not student evaluation or profiling. |
| No sharing data of children under 16 without consent | ADE does not collect or share data of children of any age. |
| No deepfake generation | ADE does not generate manipulated images, audio, or video of real individuals. |
California Education Code Section 49073.1 (AB 1584)
| Requirement | ADE Compliance |
|---|---|
| Contracts must include specific data protection provisions | All ADE contracts with LEAs include the required AB 1584 provisions, including purpose limitations, data ownership clauses, deletion obligations, and breach notification procedures. |
| Data used only for contracted purposes | Any data processed by ADE is used solely for the educational purposes specified in the contract. No secondary uses, no model training, no commercial exploitation. |
| Data belongs to student/parent/LEA | ADE's contracts explicitly state that all student data remains the property of the student, parent/guardian, and the LEA. ADE claims no ownership rights. |
| Vendor cannot retain data after contract ends | ADE's contracts include provisions requiring deletion of any LEA data upon contract termination. Because ADE does not collect student PII, this provision applies to any administrative or operational data shared during the contract period. |
| Contracts without these provisions are void | ADE proactively includes all AB 1584 required provisions in every LEA contract. We will not execute a contract that fails to meet these requirements. |
SB 243 - Guardrails for Companion Chatbots
ADE's platform delivers lessons and does not include an AI companion chatbot, conversational AI agent, or any system designed to simulate a human-like relationship with students. The ADE platform has interactive questions where students may only ask questions related to the lesson content and nothing else. They get a singular answer to their question and no conversational elements exist. If ADE introduces any interactive AI features in the future, full SB 243 compliance -- including crisis protocols, AI disclosure notices, content filtering, and annual compliance reporting -- will be implemented prior to deployment.
Protection of Pupil Rights Amendment (PPRA)
ADE does not administer surveys, collect student opinions, or gather information on the sensitive topics covered under the PPRA (political beliefs, mental health, sex behavior, illegal conduct, family relationships, income, or religious practices). ADE's platform delivers instructional content only.
4. Contractual Commitments to LEAs
ADE includes the following provisions in all contracts with California LEAs, ensuring compliance with AB 1584 and all applicable state and federal laws:
- Data Ownership: All student data remains the exclusive property of the student, parent/guardian, and the LEA. ADE claims no ownership interest in any student data.
- Purpose Limitation: Any data processed by ADE is used solely for the educational purposes defined in the contract. No secondary use, sale, sharing, or model training.
- No AI Training on Student Data: Student data is never used to train, retrain, fine-tune, or improve any AI model -- ADE's or any third party's.
- Data Minimization: ADE practices data minimization by design. No student PII is collected, processed, or stored. Only curriculum content enters the AI pipeline.
- Data Deletion: Upon contract termination, ADE will delete any LEA operational data within 30 days and provide written confirmation of deletion.
- Breach Notification: In the unlikely event of a data incident, ADE will notify the LEA within 72 hours and cooperate fully with investigation and remediation.
- Subprocessor Transparency: ADE discloses all subprocessors (including Google Gemini API) and ensures each operates under equivalent data protection terms.
- No Marketing: ADE will not use student data, interaction data, or any information obtained through the LEA relationship for marketing or advertising purposes.
- Audit Rights: LEAs retain the right to audit ADE's data practices and request documentation of compliance at any time during the contract period.
- Annual Review: ADE commits to annual review and update of its data privacy and security practices to remain current with evolving legal requirements.
5. AI Transparency & Ethical Use
In alignment with the California Department of Education's guidance on human-centered AI in TK-12 education, ADE is committed to the following principles:
Transparency
- ADE clearly discloses that its instructional content is generated with AI assistance.
- All AI-generated content is reviewed by educational professionals for accuracy, bias, and alignment with curriculum standards before delivery to students.
- ADE's AI vendor, processing methods, and data flow are disclosed to LEAs upon request and detailed in this document.
Human-Centered Design
- ADE is designed to enhance, not replace, the educator's role. Lessons supplement classroom instruction and feedback about student performance to the teachers supports teachers in delivering standards-based content.
- ADE does not simulate emotional support, friendship, or human relationships with students.
- Educators retain full control over how and when ADE content is integrated into their instruction.
Equity & Accessibility
- ADE's lesson format supports diverse learning needs, including students with disabilities who benefit from multimodal instruction.
- ADE is aligned with Universal Design for Learning (UDL) principles to ensure inclusive access for all students.
Bias Mitigation
- All AI-generated content passes through human review and accuracy filters specifically designed to identify and remove bias, inaccuracies, and culturally insensitive material.
- ADE's content review process includes evaluation against California's curriculum standards and frameworks for cultural responsiveness and inclusivity.
6. Alignment with CDE Procurement Checklist
The California Department of Education's AI guidance includes a comprehensive procurement checklist for LEAs evaluating AI tools. The following table maps ADE's capabilities to each category:
| Procurement Category | ADE Response |
|---|---|
| Instructional & Operational Alignment | ADE directly supports California curriculum standards and frameworks across ELA, Math, Science, and History-Social Science. Content is standards-based. |
| Functional Evaluation | ADE uses generative AI solely for content creation. AI functions are transparent, documented, and subject to human review. Educators can select, sequence, and control all content delivery. |
| Data Privacy & Security | Fully compliant with FERPA, COPPA, SOPIPA, CCPA, AB 1584, and PPRA. No student PII is collected. Signed DPAs available. Google Gemini API inputs are not used for model training. |
| Equity, Accessibility & Ethical Use | UDL-aligned design, bias mitigation through human review, and culturally responsive content development. |
| Transparency & Explainability | AI use is fully disclosed. Content generation process is documented. LEAs receive full visibility into data flow and AI vendor relationships. |
| Implementation & Integration | Platform is web-based and compatible with standard LMS platforms and district device environments. No additional infrastructure required. |
| Vendor Reliability & Support | ADE provides dedicated onboarding, training materials, and ongoing technical support. Service-level agreements are available. |
| Risk Assessment | Minimal risk profile due to no student data collection. Content filtering and human review guardrails prevent misinformation or inappropriate content. |
| Cost, Licensing & Sustainability | Transparent pricing with no hidden costs. Pilot programs available. Early termination provisions included in contracts. |
7. Our Commitment
American Digital Education was built to solve a critical problem: millions of students across the United States lack access to high-quality, standards-based instruction. We believe that AI is a powerful tool for closing this gap -- but only when it is deployed responsibly, transparently, and with unwavering commitment to student privacy.
We welcome questions from LEAs, parents, educators, and community members about our data practices, AI systems, and compliance posture. Transparency is not just a legal obligation -- it is foundational to the trust that makes educational technology work.